Approve a hosted gateway sign-on into one of the customer's workspaces

From the page itself: the request must carry Sec-Fetch-Site: same-origin (same-site is refused: the session cookie reaches every subdomain) or, without it, an Origin that is the web application's own (the web proxy forwards the browser's headers), and a JSON body (415 JSON_CONTENT_TYPE_REQUIRED otherwise, so no form can send it). The session must come from a sign-in that proved its email (an email code, a password, Accounts, or an OAuth provider that asserted the address verified; otherwise 403 VERIFIED_EMAIL_REQUIRED, sign in again), that email must equal the request's owner email (case-insensitive), and the user must be ADMIN or above in org_id, a workspace on a paid plan (org_entitlements.plan_code; a Stripe subscription in trialing counts as its plan) whose entitlement Accounts holds active, all read at approval. On success the session is bound to org_id (a new account-session cookie is set when it was bound elsewhere), so the console's key list and billing show the workspace that now holds the gateway's key.